You deploy Microsoft Azure Information Protection. You need to ensure that a security administrator named SecAdmin1 can always read and inspect data protected by Azure Rights Management (Azure RMS)…

Question

Options

• AFrom the Security & Compliance admin center, add User1 to the eDiscovery Manager role group.
• BFrom the Azure Active Directory admin center, add User1 to the Security Reader role group.
• CFrom the Security & Compliance admin center, add User1 to the Compliance Administrator role
• DFrom Windows PowerShell, enable the super user feature and assign the role to SecAdmin1.

• A
  19% (7)
• B
  6% (2)
• C
  8% (3)
• D
  67% (24)

Explanation

Azure Rights Management (Azure RMS) encrypts content so that only authorized users can access it. To allow a super user - such as a security administrator - to always decrypt and inspect any RMS-protected content regardless of the original permissions, you must enable the Azure RMS super user feature and then explicitly assign SecAdmin1 to that super user role. This is done via PowerShell using the Enable-AipServiceSuperUserFeature and Add-AipServiceSuperUser cmdlets (formerly Enable-AadrmSuperUserFeature). The eDiscovery Manager and Compliance Administrator roles in the Security & Compliance admin center manage search and compliance tasks but do not grant the ability to decrypt RMS-protected content. The Security Reader role in Azure AD is a read-only administrative role and does not bypass RMS encryption.

No community discussion yet for this question.